Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"gamma-mcpserver": {
"args": [
"-y",
"@modelcontextprotocol/sdk"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
This document guides you through setting up and running the Gamma MCP (Model Context Protocol) server, which allows you to generate presentations using the Gamma API directly from MCP clients like Anthropic's Claude for Desktop.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@modelcontextprotocol/sdk' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
### Summary Cross-client data leak via two distinct issues: (1) reusing a single `StreamableHTTPServerTransport` across multiple client requests, and (2) reusing a single `McpServer`/`Server` instance across multiple transports. Both are most common in stateless deployments. ### Impact This advisory covers two related but distinct vulnerabilities. A deployment may be affected by one or both. #### Issue 1: Transport re-use **What happens:** When a single `StreamableHTTPServerTransport` insta
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
### Impact A ReDoS vulnerability in the `UriTemplate` class allows attackers to cause denial of service. The `partToRegExp()` function generates a regex pattern with nested quantifiers (`([^/]+(?:,[^/]+)*)`) for exploded template variables (e.g., `{/id*}`, `{?tags*}`), causing catastrophic backtracking on malicious input. **Who is affected:** MCP servers that register resource templates with exploded array patterns and accept requests from untrusted clients. **Attack result:** An attacker sen
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with `StreamableHTTPServerTransport` or `SSEServerTransport` and has not enabled `enableDnsRebindingProtection`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access re
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in finance
Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators
A Model Context Protocol server for building an investor agent
AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.
Remote MCP server to integrate and validate self-hosted PayRam deployments.
MCP Security Weekly
Get CVE alerts and security updates for Gamma Mcpserver and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
This document guides you through setting up and running the Gamma MCP (Model Context Protocol) server, which allows you to generate presentations using the Gamma API directly from MCP clients like Anthropic's Claude for Desktop.
Gamma is an AI-powered platform designed to help users create various types of content, with a strong focus on presentations. It leverages artificial intelligence to automatically generate slides, suggest text, and incorporate imagery, allowing for rapid development of polished presentations from simple prompts or existing documents. This MCP server specifically interacts with Gamma's API to bring this presentation generation capability into environments like Claude for Desktop. Check out the Gamma API docs to learn more.
This server exposes a tool to an MCP client (like Claude for Desktop) that can take a prompt and various parameters to generate a presentation using the Gamma API. The server will return a link to the generated presentation.
Model Context Protocol servers can provide three main types of capabilities:
This server primarily focuses on providing a Tool.
This quickstart assumes you have familiarity with:
Clone the Repository / Get the Code: If this project is in a Git repository, clone it:
git clone git@github.com:gamma-app/gamma-mcp-server.git
cd gamma-mcp-server
Initialize Your Node.js Project (if not cloned):
If you created a new directory, initialize a package.json file:
npm init -y
Install Dependencies: You'll need the MCP SDK, Zod for validation, node-fetch for API calls, TypeScript, and ts-node to run TypeScript directly.
npm install @modelcontextprotocol/sdk zod node-fetch typescript ts-node @types/node
# or
# yarn add @modelcontextprotocol/sdk zod node-fetch typescript ts-node @types/node
Configure TypeScript:
You might want to adjust the tsconfig.json to suit your preferences, but the default should work. Ensure moduleResolution is set to "node" or "node16" / "nodenext" and module is compatible (e.g. "commonjs" if running with ts-node in a CommonJS context, or adjust for ES Modules). The provided src/index.ts uses ES module syntax (import ... from).
A common tsconfig.json for ES Modules with Node.js might include:
{
"compilerOptions": {
"target": "ES2020",
"module": "ESNext",
"moduleResolution": "node",
"esModuleInterop": true,
"forceConsistentCasingInFileNames": true,
"strict": true,
"skipLibCheck": true,
"outDir": "./dist" // Optional: if you plan to compile
},
"include": ["src/**/*"],
"exclude": ["node_modules"]
}
Also, in your package.json, add "type": "module" if you are using ES Modules.
API Key Configuration:
The server requires your Gamma API key. We use the dotenv package to load this key from a .env file in the project root.
.env in the root of your project (e.g., alongside your package.json).